Introduction
129
IPLink Software Configuration Guide
12 • NAT/NAPT configuration
Introduction
This chapter provides a general overview of Network Address (Port) Translation and describes the tasks
involved in its configuration.
The two most compelling problems facing the IP Internet are IP address depletion and scaling in routing.
Long-term and short-term solutions to these problems are being developed. The short-term solution is CIDR
(Classless Inter Domain Routing). The long-term solutions consist of various proposals for new internet proto-
cols with larger addresses.
Until the long-term solutions are ready, an easy way to hold down the demand for IP addresses is through
address reuse. This solution takes advantage of the fact that a very small percentage of hosts in a stub domain
are communicating outside of the domain at any given time (a stub domain is a domain, such as a corporate
network, that only handles traffic originated or destined to hosts in the domain). Indeed, many (if not most)
hosts never communicate outside of their stub domain. Because of this, only a subset of the IP addresses inside
a stub domain need to be translated into IP addresses that are globally unique when outside communications is
required.
For further information about the functionality of Network Address Translation (NAT) and Network Address
Port Translation (NAPT), consult the RFCs 1631 and 3022. This chapter applies the terminology defined in
RFC 2663.
IPLink software provides four types of NAT/NAPT:
•
Dynamic NAPT (Cisco terminology: NAT Overload)
•
Static NAPT (Cisco terminology: Port Static NAT)
•
Dynamic NAT
•
Static NAT
You can combine these types of NAT/NAPT without any restriction. One type of profile, the ‘NAPT Profile’,
holds the configuration information for all four types where configuration is required. The remainder of this
Section shortly explains the behavior of the different NAT/NAPT types.
Dynamic NAPT
Dynamic NAPT is the default behavior of the NAT/NAPT component. It allows hosts on the local network to
access any host on the global network by using the global interface address as source address. It modifies not
only the source address, but also the source port, so that it can tell different connections apart (NAPT source
ports are in the range 8,000 to 16,000). UDP and TCP connections from the local to the global network trig-
ger the creation of a dynamic NAPT entry for the reverse path. If a connection is idle for some time (UDP: 2
minutes, TCP: 12 hours) or gets closed (only TCP), the dynamic NAPT entry is removed.
An enhancement of the Dynamic NAPT allows to define subsets of hosts on the local network that shall use
different global addresses. Up to 20 subsets with their respective global addresses are possible. Such a global
NAPT address can be any IP address as long as the global network routes the traffic to the global interface of
the NAT/NAPT component.
Note
Only the NAT/NAPT component handles global NAPT addresses. Other
components of the IPLink are not accessible via these addresses.